Forensic Computer Examiner I (#8516)

Under close supervision at the one level, and under direction at the two level, Forensic Computer Examiners investigate and analyze digital evidence by performing hardware, software and virtual analyses of digital evidence in the criminalistics laboratory and in the field. To process and analyze digital evidence including disassembly of computer hardware; forensic imaging of digital media; examination of data related to criminal offenses; recovery of data from cellular telephones; and perform related duties as required.

DISTINGUISHING FEATURES

The Forensic Computer Examiner is a flexibly staffed classification found only in the Digital & Multimedia Evidence Unit of the Criminalistics Laboratory and will primarily assist with the examination of digital evidence associated with criminal activity. The Forensic Computer Examiner will interpret the results of their findings to law enforcement officers/attorneys, prepare materials for presentation in court, appear as an expert witness, and perform other related duties. At the one level, incumbents primarily handle routine cases and receive a substantial amount of on-the-job training, working closely with senior staff members in a tutorial atmosphere. After a two year probationary period at the one level the incumbent should have gained experience in acquiring, analyzing and reporting on digital evidence. Incumbents will also be required to attain certification as an EnCase Certified Examiner (EnCE) during this two year period in order to qualify for promotion to the Forensic Computer Examiner II. Employment may not be extended beyond two years if the incumbent has not met the requirements to promote to the Forensic Computer Examiner II.

EXAMPLES OF DUTIES

NOTE: The following are the duties performed by employees in this classification. However, employees may perform other related duties at an equivalent level. Each individual in the classification does not necessarily perform all duties listed.

Possession of a Bachelor’s degree in computer science, information technology, or a closely related field from an accredited college or university AND

Experience:

The equivalent of one year of verifiable full time experience conducting forensic computer examinations and cellular phone data extractions for a public or private agency. A Master’s Degree in computer science, information technology, or a closely related field from an accredited college or university may be substituted for the experience. Two additional years of verifiable full time experience may be substituted for the Bachelor’s degree.

License:

Incumbents in this class must possess a valid California Motor Vehicle Operator’s License.

Certifications:

All candidates and incumbents are required to attain and maintain on-going EnCase Certified Examiner (EnCE) certification within two years of appointment. Certified Computer Examiner (CCE) and Certified Forensic Computer Examiner (CFCE) certifications are also desirable.

Special Requirements:

Incumbents in this class must be able to work effectively in an environment in which they may encounter sensitive/confidential information and data that contains sexually explicit or disturbing content; including child pornography.

A thorough background investigation will be performed on all prospective appointees.

Incumbents in this class may be required to work day, evening, night and rotating shifts, including weekends and holidays and may be required to respond to crime scenes.

Incumbents must successfully complete annual proficiency testing in the area of computer forensics as required by ASCLD/LAB accreditation standards.

NOTE: The Civil Service Commission may modify the above Minimum Qualifications in the announcement of an examination.

KNOWLEDGE AND SKILLS

NOTE: The level and scope of the following knowledge and abilities are related to duties listed under the “Examples of Duties” section of this specification.

• Communicate effectively both orally and in writing.
• Examine and analyze computer hardware, software and electronically stored data pertaining to law enforcement investigations.
• Collect, transport, process and secure evidentiary materials.
• Effectively prepare and present detailed reports of findings.
• Find and extract electronically stored information to be used as evidence.
• Work with various operating systems including Window, MacOS, Linux, and Unix file systems.
• Work with different levels of Redundant Array of Independent Disks (RAID) 0, 1, 5, 10, etc.
• Work across most hardware platforms including desktops, laptops, servers and enterprise-level storage devices.
• Manage several projects at once and maintain precise notes and required documentation.
• Establish and maintain effective working relationships.
• Work effectively in an environment in which incumbents may encounter sensitive/confidential information and data that contains sexually explicit or disturbing content; including child pornography.

CLASS SPEC HISTORY

DS:po 8/6/09
Newspecs: 8516.doc
CSC Date: 11/4/2009

BENEFITS

Alameda County offers a comprehensive and competitive benefits package that affords wide-ranging health care options to meet the different needs of a diverse workforce and their families. We also sponsor many different employee discount, fitness and health screening programs focused on overall well being. These benefits include but are not limited to*: